The history.pushState/replaceState should check for minimum arity exception.

Source/bindings/core/v8/custom/V8HistoryCustom.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 45 matching lines @@
     RefPtr<SerializedScriptValue> serialized = history->state();
     value = serialized ? serialized->deserialize(info.GetIsolate()) : v8::Handle<v8::Value>(v8::Null(info.GetIsolate()));
     V8HiddenValue::setHiddenValue(info.GetIsolate(), info.Holder(), V8HiddenValue::state(info.GetIsolate()), value);
 
     v8SetReturnValue(info, value);
 }
 
 void V8History::pushStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     ExceptionState exceptionState(ExceptionState::ExecutionContext, "pushState", "History", info.Holder(), info.GetIsolate());
+
+    if (UNLIKELY(info.Length() < 2)) {
+        setMinimumArityTypeError(exceptionState, 2, info.Length());
+        exceptionState.throwIfNeeded();
+        return;
+    }
+
     RefPtr<SerializedScriptValue> historyState = SerializedScriptValueFactory::instance().create(info[0], 0, 0, exceptionState, info.GetIsolate());
     if (exceptionState.throwIfNeeded())
         return;
 
     TOSTRING_VOID(V8StringResource<TreatNullAndUndefinedAsNullString>, title, info[1]);
     TOSTRING_VOID(V8StringResource<TreatNullAndUndefinedAsNullString>, url, info[2]);
 
     History* history = V8History::toImpl(info.Holder());
     history->stateObjectAdded(historyState.release(), title, url, FrameLoadTypeStandard, exceptionState);
     V8HiddenValue::deleteHiddenValue(info.GetIsolate(), info.Holder(), V8HiddenValue::state(info.GetIsolate()));
     exceptionState.throwIfNeeded();
 }
 
 void V8History::replaceStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     ExceptionState exceptionState(ExceptionState::ExecutionContext, "replaceState", "History", info.Holder(), info.GetIsolate());
+
+    if (UNLIKELY(info.Length() < 2)) {
+        setMinimumArityTypeError(exceptionState, 2, info.Length());
+        exceptionState.throwIfNeeded();
+        return;
+    }
+
     RefPtr<SerializedScriptValue> historyState = SerializedScriptValueFactory::instance().create(info[0], 0, 0, exceptionState, info.GetIsolate());
     if (exceptionState.throwIfNeeded())
         return;
 
     TOSTRING_VOID(V8StringResource<TreatNullAndUndefinedAsNullString>, title, info[1]);
     TOSTRING_VOID(V8StringResource<TreatNullAndUndefinedAsNullString>, url, info[2]);
 
     History* history = V8History::toImpl(info.Holder());
     history->stateObjectAdded(historyState.release(), title, url, FrameLoadTypeRedirectWithLockedBackForwardList, exceptionState);
     V8HiddenValue::deleteHiddenValue(info.GetIsolate(), info.Holder(), V8HiddenValue::state(info.GetIsolate()));
     exceptionState.throwIfNeeded();
 }
 
 } // namespace blink